Sub-processors
This English translation is provided for information purposes only. In the event of any discrepancy, the French version alone is authoritative. Read the French version
Last updated: October 9, 2026
1. Context
This page lists the service providers that process personal data on behalf of Korvus. For the data collected via the snippet on its clients' websites, Korvus acts as a processor within the meaning of Article 28 of the GDPR. For prospects collected directly on korvus.fr, Korvus acts as the data controller.
For details of the scope of Korvus's processing on behalf of its clients, see the privacy policy.
2. List of sub-processors
| Sub-processor | Purpose | Type of data | Location | Safeguards |
|---|---|---|---|---|
| Scaleway (Dédibox SAS, Paris) | Hosting (Serverless Container, Managed PostgreSQL, Managed Redis, Object Storage, Edge Services CDN) | All service data (Korvus client accounts and data collected by the snippet) | France, fr-par region (Paris) | EU processor, hosting with no transfer outside the EEA |
| Stripe Payments Europe Ltd | Processing of Korvus service subscription payments | Korvus client billing data (name, email, payment method). No visitor data from client websites is transmitted. | Ireland (EU headquarters), with service providers in the United States | EC Standard Contractual Clauses 2021/914 (Module 3, processor to sub-processor), PCI-DSS certification |
| Mistral AI SAS | Generation of the AI diagnosis (alert summary) when each incident is created | Anonymized alert payload (technical metadata of the anomaly, no visitor identifier) | France | EU processor, no transfer outside the EEA |
| Scaleway TEM (same Scaleway group) | Sending of transactional emails (alerts, account emails, verification codes) | Recipient email address and notification content | France, fr-par region | EU processor |
| PostHog Inc. | Product analytics for the app.korvus.fr platform: events, heatmaps, replays, performance and browser errors | User and organization UUIDs, account metadata, navigation, interactions and business content displayed. Input values, passwords, API keys and webhooks are excluded. | Germany (PostHog Cloud EU, Frankfurt) | PostHog DPA, Standard Contractual Clauses and safeguards applicable to any transfers outside the EEA |
| Cloudflare, Inc. | Delivery of the korvus.fr website, abuse protection and storage of prospect requests in D1 | Business email address, optional e-commerce website, proof of consent and minimal technical metadata | D1 under EU jurisdiction; global delivery network | Cloudflare DPA and applicable Standard Contractual Clauses |
| Lempire SAS (Lemlist) | CRM management of prospects and sending of the communications they have consented to or that follow up on their audit request | Business email address, e-commerce website domain (optional, except for an audit request) and page from which the request was made | Main databases in the European Economic Area | Lemlist DPA; Standard Contractual Clauses for any transfers by sub-processors outside the EEA |
3. Data of client website visitors
For the data collected by the snippet on client websites, only Scaleway actually receives the data collected by the snippet on client websites, for storage purposes. Stripe, Mistral AI and Scaleway TEM only have access to Korvus account data or to anonymized alert payloads. PostHog only receives usage telemetry from the app.korvus.fr platform, never the visitor sessions collected by the snippet. No visitor identifier is transmitted to any third party other than Scaleway storage.
This rule concerns visitors observed via the snippet on client websites. It is separate from the voluntary form on korvus.fr: people who sign up through it share their contact details with Cloudflare and Lemlist for prospect relationship management.
4. Changes to this list
In accordance with Article 28(2) of the GDPR, Korvus undertakes to notify its clients by email 30 days in advance of any addition or replacement of a sub-processor. The client retains the right to object to such a change.
5. Contact
For any question about our sub-processors: [email protected].